I got your point because only forwarded packets can be captured so in my first clause i can have with action forward and capture permit ip any any in my second clause i can have only forward and no capture permit 111 (ipx) any any permit eigrp any any permit igmp any any then i can control which vlans i can add in the filter list to capture traffic i have a question if you can please answer MSFCA -vlan10---MSFC vlan20 ---fwsm vlan20. Valns 30,40,50 assigned to vlan fwsm. Valn 10 of msfc connected to ISP then in caputre list we add vlans20,30,40,50. If a host on the interenet which gets routed via vlan 10 ( can be any ip address) say 4.2.2.16 access an ip address 40.2.2.2. This 40.2.2.2 is vlan 20 so the packet from 4.2.2.16 comes to vlan 10 on msfc for 40.2.2.2 , msfc looks for arp on vlan 20,fwsm has a static for 40.2.2.2 with 192.168.30.2 which is on vlan 30, the packet then goes from vlan 20 with source as 4.2.2.16 and nat to 192.168.30.2 from fwsm to vlan 30 . destination replies back , packet goes from vlan 30, 20 and 10 The question is packet is originated from vlan 10, goes to vlan 20 and then reach 30 and vic versa. but vlan filter and idsm is configured to capture traffic vlan 20,30. will the traffic from source 40.2.2.2 will be captured and if anything malicious will idsm fire an alert Thanks ... View more

Hello Thanks for the response ip any any in the customized_traffic has clause with action capture , can you please clarify the second clause with action as forward will not be hit. shouldnt the action capture should only capture the traffic? my other question about the protocol number ipx (111), eigrp, igmp,pim ,we think its required though we have ip any any permit in the second clause. will can you please enhance on it. Thanks ... View more